CVE-2025-39760: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-39760 was disclosed on September 11, 2025, affecting the Linux kernel's USB core configuration component. The vulnerability involves an out-of-bounds read issue in the SS endpoint companion parsing functionality, specifically within the usbparsessendpointcompanion() function (NVD, Ubuntu).

The vulnerability stems from a logic flaw where the usbparsessendpointcompanion() function checks the descriptor type before verifying the length, which could potentially lead to reading outside of the buffer size. The fix involves modifying the code to check the size first before examining any fields in the descriptor (NVD).

The vulnerability could potentially allow an attacker to read data outside of intended buffer boundaries in the Linux kernel's USB subsystem, which might lead to information disclosure or system instability (NVD).

The issue has been resolved through patches in the Linux kernel. The fix involves modifying the usbparsessendpointcompanion() function to properly validate buffer sizes before accessing descriptor fields (NVD).